this post was submitted on 10 Nov 2023
3 points (100.0% liked)

Self-Hosted Main

515 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
 

So, im a newbie here.

I have some services running.

I put today all behind Nginx as a reverse proxy. And im using ssl/tls from letsencrypt.

I found this ip in my access.log from Nginx.

83.97.73.87 - - [10/Nov/2023:12:20:35 -0300] "GET /_ignition/execute-solution HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:23:23 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:45:26 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

I look for that ip and it seems that is a BAD IP!!!

Look https://www.abuseipdb.com/check/83.97.73.87

Im fine or i need to do something to avoid this?!

Im safe or this could made something to my server?

top 7 comments
sorted by: hot top controversial new old
[–] cshaiku@alien.top 1 points 1 year ago

Naw, you're fine. It's just russian bots trying to scrape your site, looking for vulnerabilities.

This may prove helpful: https://stackoverflow.com/questions/58249085/how-to-solve-facade-ignition-http-middleware-ignitionenabled

[–] bl_r@beehaw.org 1 points 1 year ago

This looks like a port scanning address, which is normal. Being scanned is just a fact of life if you host a service on the internet. What exactly was in your access log? Is it a connection on / ? Is it a 404 on a weird path? Is it accessing data on a service you run?

Personally, I’d block the IP and move on, since 99 times in 100, its not too big of a deal since an automated scan won’t do much. If it is scanning services you actively run, it would warrant digging in deeper, reading all logs and bit more closely, but it is still not too likely it will result in an intrusion.

[–] WiseCookie69@alien.top 1 points 1 year ago (1 children)

Normal background noise. You expose stuff to the public and in return you make friends with a bunch of bots.

[–] 9acca9@alien.top 1 points 1 year ago

lol, thanks.

[–] cdemi@alien.top 1 points 1 year ago

Welcome to the Internet. Check out Crowdsec and WAFs

[–] MacaroniOnly@alien.top 1 points 1 year ago

The unfortunate truth of the internet is that once you reveal a service to it, bots and crawlers will be over that service immediately. As long as you have a firewall, your server is up-to-date, and your services are behind some sort of login page or allow list, you'll be fine

[–] OxFEEDBEEF@alien.top 1 points 1 year ago

/_ignition/execute-solution

It's a bot trying to scan for an exploit for Laravel (a PHP framework). You'll see thousands of those types of scans drive by every day. Welcome to the Internet. Last time I deployed a new server online it took about 2 minutes for the first one to come knocking.

You can use something like Crowdsec to block this, or some other solution if you want to keep your services on the internet via a proxy.

Alternatively, if you're the only user, don't host them on the Internet directly, but hide them behind a VPN.